Disable TLS close_notify after downstream FIN in Envoy to avoid RST from non-compliant clients

Title: Disable TLS close_notify after downstream FIN in Envoy to avoid RST from non-compliant clients

Description:

When Envoy receives a FIN packet from a downstream client (e.g., certain implementations like the default .NET HttpClient), it currently sends a TLS close_notify alert before closing the connection. However, some clients—after sending a FIN—do not expect or properly handle a subsequent TLS close_notify and respond with a TCP RST. This behavior, while non-compliant with strict TLS shutdown semantics, is common in widely used clients. The RST can cause spurious connection errors or log noise on the server side. This feature request proposes an option in Envoy to suppress the TLS close_notify when the downstream has already initiated graceful TCP shutdown via FIN, thereby accommodating such non-compliant clients and enabling smoother connection termination in heterogeneous environments.

[optional Relevant Links:]

https://github.com/dotnet/runtime/issues/17389